Dependency cooldowns turn you into a free-rider

Article critiques dependency cooldowns—the emerging practice of delaying dependency updates to catch supply chain attacks—as a flawed approach that relies on free-riding early adopters as unpaid testers. It proposes upload queues (centralizing publication-to-distribution delays at package indexes, following Debian's precedent) as a superior alternative requiring no per-project configuration. The author extends this analysis to LLM supply chains, identifying a novel threat: markdown files treated as executable format (e.g., Claude Agent Skills), requiring double upload queues with moderation and agent owner approval.